Authorization shibboleth.context-check.Condition

[Joshua Brodie]

We have an application whereby only authorized if user has either a
particular eduPersonEntitlement (https://example.edu/employee/active) OR
memberOf (cn=adhoc,ou=example,ou=edu).

Have I followed good practice with 'shibboleth.context-check.Condition' as
shown below -- I haven't been able to test if it works and suspense if this
is correct (test ldap down).


<bean id="shibboleth.context-check.Condition" parent=
"shibboleth.Conditions.OR">

        <constructor-arg>

            <list>

                <bean parent="shibboleth.Conditions.RelyingPartyId"
c:candidates="#{ 'https://sp.example.org' }" />

                <bean class=
"net.shibboleth.idp.profile.logic.SimpleAttributePredicate"

                        p:useUnfilteredAttributes="true">

                    <property name="attributeValueMap">

                        <map>

                            <entry key="eduPersonEntitlement">

                                <list>

                                    <value>
https://example.edu/employee/active</value>

                                </list>

                            </entry>

                             <entry key="memberOf">

                                <list>

                                    <value>cn=adhoc,ou=example,ou=edu</value
>

                                </list>

                            </entry>

                        </map>

                    </property>

                </bean>

            </list>

        </constructor-arg>

    </bean>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170623/4eaacf77/attachment-0001.html>